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Organization ofCvberiu the Netherlands (L 1 ) 



(S SI REL TO USA., NLD) Hie meeting began with a briefing from the Dutch about 
their reorganization and t he creati on of the new SIGINT and Cyber Division and Single 
Point of Contact (SPoC). noted that Project^^^^^^|to create this new division 

appears to be on track, with MIVD and AIVD technical specialists starting to be pulled 
out of their original locations to join the new division., located at AIVD HQ in 
Zoetermeer. This new division will be headed by a steering committee comprised of 
MIVD Director Pieter Bindt and AIVD Director Rob Bertholee. Underthem will be the 
SPoC. headed as s si denote, plans are under way to visit 

NSA at the end of May . Slide 7 includes a couple of abbreviations: AS = MIVD s 
SIGINT Division, SOM — Al\ D 5 Special Investigating Committee, Q\10 — the support 
organization. The SPoC technical specialists will work closely with the analysts 
(including branch ). who will remain in AD D outside the new entity. NLNCSA 
(the Dutch equivalent of I AD > will probably also be pulled into the new entity. 

(S SI REL TO USA, NLD) Tire Dutch created the National Cyber Security Center 
(NCSC) in Jan 2012 to cover general (not military) cyber issues, and this center is sliil 
dealing with growing pains It is having difficulty filling all its vacancies, it still lacks a 
legal frame work, and private companies fight any public notification that cyber attacks 
have taken place When asked where to turn for help in the case of an intrusion on a 
commercial entity, the ans wer wa s that it depends — if the help needed is technical, then 
AIVD; otherwise, NCSC, averred chat AIVD has good relations with companies, 
Hie national police (KLPD)has a liaison with NCSC also. 

{$. SI REL TO USA, NLD) The National Detection Network (NDN) governs Dutch 
sensors. This network is DEVELOPING — some sensors are public and some are private, 

ionit- entities :: 1 and thet im o the NCSC I 
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CS/ SI- REL TO USA, NLD) Some other notes: 

• Die Dutch do not have red or blue teaming yet 

* AIVD is concerned with espionage, not crime 

* Die Dutch are working toward having only one IP point where all government 
agencies touch the internet, because this will be easier to monitor defend 

* 80 percent of NSA tools used to find malware are commercial , while 100 percent 
of Dutch tools are 

• In the cyber realm, there is no ONE government agency in charge vet. but it will 
eventually be the N T CSC 

• Diere is still no cable access vet. but the laws mav be changed in the next vear or 
two. However, Dutch lawyers believe that they can tap it now If it is for 
DEFENSIVE measures only 

Webfora and the Onion Router {TORI (I_ ) 



(S SI REL TO USA r NLD) The web forum discussion was of greater interest. Die 
Dutch provided an overview of their data presentation tool (at a very high level). Diey 
acquire mySQL databases via CN’E access. I 





They Ye looking at marrying up the forum 
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data with, other social network info, and trying to figure out good wavs to mine the data 
that they have. 



(S.VSL.REL TO USA. NLD) Questions the Dutch had were based on our analytic 
tradecraft H^Hnoted that we use keywords to some extent, and outlined the division of 

rgeting. if that partner engagement is of interest 
want to track their activities on ^^^|and 
|suspects we can focus on tradecraft and 
general analytic phiLosophv and build quite a bit of credibility that way. 



effort between ^^^^^Jand sustained ta 
(from^^^l perspective, it is in that we ' 
maximize their exploitation of that data;. 



(S'. ‘St RELTO USA. NLD}^^H gave a brief up date oil our efforts with Tor, noting that 
the multi-national effort seemed the best avenue for a sustained capability at present and 
we are actively working our legal processes to make progress. 



ACTION ITEMS FROM 14 FEBRUARY 2013 MEETINGS ON SIGINT, ‘CYBER 

(These action items have also been sent separately) 

1 ) (S '.'SI : CDO IAD and NTQC: Draft a cyber MOU for Dutch review 

— CDOj SIGINT to inform DIRNSA that MOU will be drafted (DIRNSA and AIVD 
Direct or both informed: NTOC will draft MOU: 



2)(S SI: CDO 'SIGINT: Seek preview of public version of 



message and 



convev to 




| tli at having a preview in the future in time to alert Dutch 
CERTS would be ideal (done — net enough time to obtain preview for this round, but 
the idea for the future has been conveyed : 




4) (S "SI) CDO 'SIGINT: 
Dutch (done) 



Will try to obtain updated version of 





5) ($.'.• Will share informations handles, etc. on hackers 

6) (S//S I) CDO SIGINT: Will create Cyber forum will forward Tutelage and 

Malware presentations, Webfora article, and agenda via (briefings sent, but 

awaiting list of which U.S. personnel to put in Cyber forum) 
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